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Abstract 

There is agreement amongst scholars regarding the lack of a unique profile for lone wolf actor 
terrorists. Therefore, this study focuses on the characteristics of the lone attack, which has 
rarely been studied. The study seeks to fill these gaps, examining the element of opportunity and 
situational conditions by focusing on the offence/attack rather than on the offender/attacker in 
cases of run-over terrorist attacks. In order to shed more light on this dangerous phenomenon 
of lone-actor terror in general, and lone run-over attacks more specifically, this study examines 
all 62 run-over attacks carried out in Israel between January 2000 and March 2016. Data for 
this study were obtained from confidential and open sources. The study’s findings reveal certain 
characteristics of lone run-over attacks regarding the ‘four pillars of opportunity’ (target, weapon, 
tools/training and facilitating conditions). These findings suggest that, in order to prevent run- 
over terrorist attacks or to minimize the damage, one should not concentrate primarily on 
identifying the profile of the potential attacker. Rather, effective counter-measures should identify 
the run-over attack elements of situational opportunities and introduce effective situational crime 
prevention measures that have been found to be effective in preventing non-terrorist crime. 

Keywords 

Counter-terrorism, lone wolf actors, run-over attacks, situational crime prevention, 
target hardening 


Introduction 

Over the last decade, there has been a dramatic increase in the volume and the severity 
of‘lone wolf’ 1 fundamentalist terrorist attacks. 2 By ‘lone wolf’ actors we refer not neces¬ 
sarily to individuals who truly act in isolation, without contact with other individuals, but 
to terrorists who before and during an attack have no ties and orders from a known ter¬ 
rorist organization (see Burton and Stewart, 2008; Spaaij, 2010). Security agencies are 
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experiencing difficulties in coping effectively with this form of terrorism, which is 
receiving growing public attention. The agencies’ difficulties stem from the fact that this 
form of terrorism is often less traceable and more unpredictable in comparison with 
organizational terrorism. 3 Whereas terrorist organizations maintain infrastructure and 
communication channels that allow monitoring and interception (Perry, 2014), individu¬ 
ally planned and executed attacks are more difficult to detect prior to the act. Owing to 
the challenge that dealing with lone terrorists presents, there arises the need to study the 
phenomenon and possible ways to prevent it, or at least to minimize its damage. 

Limited research has focused on lone terrorists, mostly concentrating on identifying 
risk factors (such as personal, mental, social, economic, political, religious and other 
ideological characteristics) that increase the probability of involvement in terrorism. 
These studies tend to focus on the profile of the perpetrator (Martin, 2015). Yet it appears 
that there is agreement amongst scholars that there is no specific profile for lone-actor 
terrorists (Bakker and De Graaf, 2011; Gill, 2015; McCauley and Moskalenko, 2014). 

If there is no specific profile of the lone attacker, one may ask whether there is a pro¬ 
file for the attack itself. Few studies (Gill, 2015; Schuunnan et al., 2017) examine the 
characteristics of lone-wolf attacks, their apparatus and methods of preparation, and 
assess how these attacks differ from what we already know regarding attacks carried out 
by terrorist organizations. This study seeks to fill those gaps, using the Rational Choice 
approach (Felson and Clarke, 1998). It examines the element of opportunity by focusing 
on offences rather than on offenders and by studying the characteristics of the attacks 
(rather than those of the attackers). 

Freilich and Chermak (2009) and Kennedy (2010) recommend conducting in-depth 
analyses of specific kinds of terrorist attacks. In keeping with their recommendation, this 
study specifically examines lone terrorist run-over attacks, which are carried out by uti¬ 
lizing a vehicle or heavy machinery, to run over the victims of the attack. This is because 
this deadly attack method is relatively common amongst lone attackers (and receives 
encouragement from terrorist elements). The two deadly attacks in Europe - Nice in July 
2016 (Mohamed Lahouaiej-Bouhlel), and Berlin in December 2016 (Anis Amri) - illus¬ 
trate the danger of this phenomenon of run-over attacks, which require little advance 
planning or logistical support but have distressing consequences. 

In order to shed more light on this dangerous phenomenon, this study specifically exam¬ 
ines the situational conditions as well as the characteristics of lone run-over terrorist attacks 
in Israel. The main question of the study is whether there are specific characteristics of lone 
run-over attacks. The study attempts to comprehend the decision-making choices that lone 
terrorists make before and during their run-over attack. Our assumption is that these choices 
are an outcome of specific opportunities, as perceived by the attacker, to commit such acts 
of terror. This means that individuals make their decision to engage in acts of terror in par¬ 
ticular settings. Should such conceivable common features for lone run-over attacks exist, 
it might enable effective situational crime prevention (SCP) counter-measures to prevent 
specifically lone run-over attacks or at least minimize their damage. 

Although we studied the entire population of the attacks (62 cases between January 
2000 and March 2016), all of the cases occurred only in Israel. The literature on terrorism 
has many examples of the Israeli context, owing to the fact that it is a Western-style 
democracy, has a relatively high per capita income, and experiences a high frequency of 
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terrorist events (Waxman, 2011). Scholars have previously noted the benefits of using 
the Israeli ‘experience’ to inform and assist European countries in dealing with an 
increasing threat and frequency of terrorism (Ganor, 2011). Furthermore, policing, intel¬ 
ligence and military officials often travel to Israel in order to learn from the experiences 
of their Israeli counterparts with respect to terrorism. 

The following section discusses the theory of Rational Choice and the four pillars of 
the attack opportunity as applied to the lone terrorist. In line with these four pillars of 
terrorist opportunity, a number of predictions regarding lone run-over attacks are pre¬ 
sented. We then describe the research method employed as well as the population of lone 
terrorist run-over attackers and the specific attacks studied. The fourth section presents 
the study’s findings concerning the characteristics of the run-over attacks studied. Lastly, 
we focus on how analysing the characteristics of run-over attacks presents an opportu¬ 
nity to better understand lone wolf terrorism in general and lone wolf run-over terrorism 
in particular and propose suggestions for preventive efforts to deal with this complicated 
phenomenon. 

The ‘four pillars of the terrorist opportunity’ and the lone 
terrorist 

As mentioned, analyses of the profile of attackers do not provide enough insight regarding 
the phenomenon of lone wolf attacks (Bakker and De Graaf, 2011; Gill, 2015; McCauley 
and Moskalenko, 2014). Therefore, we have chosen to focus on the characteristics of the 
attack. Our decision to focus on the attack resembles criminological studies that have opted 
to analyse the criminal act rather than the perpetrator’s profile (Clarke and Newman, 2006). 

The course of every act of crime/terrorist attack, including those conducted by lone 
wolf attackers, is dictated by the immediate circumstances of the situation (Clarke, 
1997). According to Clarke and Newman (2006), the opportunity that relates to the cir¬ 
cumstances of an attack should therefore be analysed. These circumstances related to 
opportunity can be divided into four elements, which are referred to as the ‘four pillars 
of opportunity’: target, weapon, tools/training and facilitating conditions. These four 
elements are essential when carrying out a terrorist attack (Bakker and De Graaf, 2011; 
Clarke and Newman, 2006; Fahey et al., 2012). In the following, each of these four pil¬ 
lars of opportunity will be described as it relates to lone wolf terrorism. 

Target 

Theoretically, potential targets are unlimited; but several fundamental characteristics 
make certain targets more attractive for terrorists (Clarke and Newman, 2006; Newman 
and Hsu, 2012). Lone wolves, unlike terrorists affiliated with organizations whose aim is 
to gain support (whether from other terrorists, potential recruits or financiers), are more 
independent in their target selection (Malkki, 2014; Spaaij, 2010, 2012). 

The literature divides targets chosen by terrorists into two categories: hard and soft 
targets (Asal et al., 2009; Newman and Hsu, 2012). Hard targets are better defended and 
therefore more difficult to attack (that is, government buildings, military bases). Soft 
targets are more exposed and therefore facilitate easier attacks (that is, public and easily 
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accessible areas, roads and public transport, shopping centres and outdoor public events). 
Although hard targets might be more difficult to attack, a successful terrorist attack 
against a hard target may mean increased public and media attention and increased fear 
and anxiety and have a greater effect (Clarke and Newman, 2006; Newman and Hsu, 

2012) . Despite the significant achievement that hard targets provide to the terrorist, lone 
wolves more often choose soft targets owing to their limited resources and lack of organ¬ 
izational infrastructure (Institute for Economics and Peace, 2014; Spaaij, 2010, 2012). 

The accessibility of the target to the attacker is another major consideration. The dis¬ 
tance, the complexity of the journey, the attacker’s acquaintance with the route and the 
target area, escape route options, the possibility to bring or receive a weapon close to the 
target - all play a significant role in this resource versus benefits consideration (Clarke 
and Newman, 2006; Spaaij, 2010, 2012). Therefore, a significant number of terrorists 
select targets close to their place of residence (Becker, 2014 4 ; Newman and Hsu, 2012). 
Many lone terrorists do not leave their hometowns when attempting to carry out an attack 
(Becker, 2014; Capellan, 2015; Spaaij, 2010,2012). Alongside the low level of resources 
required for the journey, another advantage of a nearby target is the attacker’s level of 
experience and knowledge. For lone terrorists, who often do not have the time or ability 
to arrange pre-training or dry runs, this kind of knowledge can be significant (Bakker and 
De Graaf, 2011; McCauley, 2013). Familiar targets are usually a part of the lone terror¬ 
ist’s daily routine - workplace or on the way to work, or places they frequent in the sur¬ 
roundings neighbourhoods (Brantingham and Brantingham, 1993). Indeed, most lone 
attacks occur in familiar places (Becker, 2014; Gill et al., 2014). On the other hand, some 
lone terrorists choose to conduct the attack outside their familiar area in order to demon¬ 
strate the importance of their ideology (Bakker and De-Graaf, 2010; Gill et al., 2014; 
Moskalenko and McCauley, 2011; Wright, 2013). According to a Meir Amit report 
(2014), run-over attacks in Israel during 2014 occurred in open public spaces, such as 
light rail stations, which increases the chance that the terrorists will be able to escape. 

Target selection is one of the most essential stages in the terrorist’s decision-making 
process (Clarke and Newman, 2006; Drake, 1998; Jordan, 2008; Nesser and Stenersen, 
2014). When asking which targets are the most common amongst terrorists we find that 
private citizens and property, businesses, and police and military targets account for over 
50 percent of the total (LaFree and Dugan, 2009, Nesser and Stenersen, 2014; Wright, 

2013) . Spaaij (2012) found that lone wolf terrorists in the US and Europe were more 
likely to attack civilian targets than governmental or military targets. Similarly, an 
updated analysis of 84 terrorist attacks occurring in the US between 1940 and 2012 
revealed that the majority (about 60 percent) of lone wolves chose civilian targets, 32 
percent chose government targets, whereas military targets accounted for only about 7 
percent of the attacks (Becker, 2014). However, this trend may be changing: a recent 
research report by Hamm and Spaaij (2015) reveals that, in the US, uniformed police and 
military officers have become the preferred target for lone wolves. 

Weapon 

As with the target selection, the terrorist’s weapon-selection process is guided by a care¬ 
ful consideration of resources versus benefits. Accordingly, the leading considerations in 
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the choice of weapon are how difficult it will be to obtain it, on the one hand, and how 
much potential damage it could cause, on the other (Clarke and Newman, 2006). The 
literature describes four main groups of weaponry used in terrorist attacks: cold weapons 
(such as knives or axes), firearms, explosives and unconventional (nuclear or chemical) 
weapons (LaFree and Dugan, 2009; Spaaij, 2012). 

Cold weapons are easy to come by, difficult to regulate, simple to operate and simple 
to dispose of after the attack (Clarke and Newman, 2006; Gill et al., 2014; Teich, 2013). 
Another weapon that is easy to come by, difficult to regulate and simple to operate is the 
vehicle used in run-over attacks. Such a car, tractor or other motorized machinery is an 
everyday object turned into a weapon. Flamas, mostly via social media, campaigned to 
promote vehicular terrorism as a preferred method of Palestinian attacks, for a high num¬ 
ber of casualties. 5 

World wide, explosives and fireanns are the most common weapons used by terrorists 
(LaFree and Dugan, 2009), although there seems to be a decline in the use of explosives 
(Clarke and Newman, 2006; Institute for Economics and Peace, 2014). According to 
Hamm and Spaaij (2015), prior to the 9/11 terrorist attack, a substantial number of the 
lone wolf attacks involved bombings. However, since 9/11, there has been a decrease in 
bombings in the US, which could be attributed to government prohibitions against sell¬ 
ing materials for improvised bomb-making enacted in the aftermath of the Oklahoma 
City bombing. Instead, the preferred type of weapon has become different types of high- 
velocity firearms. Most terrorists use only one kind of weapon during the attack (Van 
Dongen, 2014). Spaaij (2010) studied lone terrorists from 15 different countries and 
found that firearms are one of the three preferred weapons. Specifically, in the US it is 
the preferred weapon because of the relative ease with which firearms may be obtained. 
When compared with members of terrorist organizations, lone attackers lack resources 
and knowledge. This suggests that they would tend to choose relatively uncomplicated 
means of obtaining and operating weapons. This choice leads them to avoid hard targets 
(Becker, 2014; Borum, 2013; Gill et al., 2014). 

Tools and training 

The term ‘tools’ refers to items or equipment that can be used for planning and preparing 
the terrorist attack. Such objects are usually associated with daily routine activities 
(Bakker and De Graaf, 2011; Clarke and Newman, 2006; Meyer, 2013). There are many 
possible tools, such as documentation (passports, identity documents or driving licences), 
transportation and technologies. As to transportation means. Gill, Horgan and Deckert 
(2014) found that the use of a private car for transport was far more common for lone 
wolf terrorists than for terrorist organizations. Technologies such as cell phones and the 
worldwide net have created a wide range of possible tools for terrorists, especially lone 
wolves. They also tend to use the Internet for virtual interactions and as a learning source. 
For lone attackers, online manuals are the perfect solution, enabling them to be radical¬ 
ized, taught and trained, as well as receive assistance in planning and executing attacks 
(Bhui and Ibrahim, 2013; Nesser and Stenersen, 2014; Stewart, 2011; Weimann, 2012). 
Social media play an important role, bringing together individuals who share the same 
ideology for the purpose of finding spiritual support and guidance (Pantucci, 2011; 
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Weimann, 2012). Terrorist organizations exploit the Internet to appeal to potential lone 
attackers and to seduce, train and encourage them to attack (Bhui and Ibrahim, 2013; Gill 
and Comer, 2015; Weimann, 2012). Gill, Horgan and Deckert (2014) found that 46 per¬ 
cent of a sample of 119 lone wolves had been trained for the attack through the Internet 
and other media. 

Facilitating conditions 

Facilitating conditions are the social and physical arrangements of society that increase 
the probability of terrorism (Clarke and Newman, 2006). Whereas the tools are the tan¬ 
gible elements (such as cell phones) used to execute the attack, facilitating conditions are 
the societal, environmental and institutional circumstances that enhance the opportunity 
of the terrorists and increase the odds that an attack will be carried out successfully 
(Abadie, 2004; Piazza, 2006). 

Facilitating conditions can be related to political, sociological, economic and personal 
factors (Clarke and Newman, 2006; LaFree and Bersani, 2014). In Western democracies, 
the need to protect human rights may stand in the way of effective counter-terrorism, 
resulting in the rise of lone terrorism (Bakker and De Graaf, 2011; Borum, 2013; LaFree 
et ah, 2010). In contrast to terrorist organizations, lone extremists tend to operate in 
developed democratic countries where the political regime is stable, such as the US and 
West European countries (Becker, 2014; Spaaij, 2010; Spaaij and Hamm, 2015). 

Social disorganization may serve as a facilitating condition for terrorism, when mech¬ 
anisms of social control lose their ability to function (Davies, 1962). Similar to terrorist 
organizations, lone wolf extremists tend to operate in heterogeneous countries, espe¬ 
cially in Western Europe (Caruso and Schneider, 2013), where some ethno-religious 
groups express their negative feelings toward majority or minority groups through acts 
of terror (Appleton, 2014; Spaaij, 2010; Teich, 2013). Heterogeneity increases hostilities 
between ethnic and religious groups, which may lead to extremist actions against an out¬ 
group by those who share mutual ideological beliefs (Freilich et ah, 2015; Gruenewald 
et ah, 2013). 

Another important facilitating condition is replicating recent successful attack plans. 
Imitating prior attacks in this fashion (‘copycat’) may assist offenders to overcome the 
gap between planning and executing their attack plan. This is even more important for 
lone actors, because their access to knowledge and resources is limited and following 
others can be used as a ‘shortcut’ to effective attacks. Accordingly, scholars have found 
evidence of copycat behaviour amongst lone actors in the US (Gill, 2015). 

Hypotheses based on the four pillars of lone attack opportunity 

The above-mentioned literature indicates that, contrary to the analysis of risk factors in 
the personal profile of lone attackers, studying the (four pillars of) opportunity provides 
a more in-depth understanding of the attack and its characteristics. Moreover, the deci¬ 
sions made by terrorists are determined by incentives and opportunities that are unique 
to a specific type of offence and its contextual circumstances (Clarke and Cornish, 2001; 
Felson and Clarke, 1998). Therefore, as previously mentioned, it is recommended that 
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researchers study the terrorists’ strategies and specific attack plans by analysing the 
methods, mechanisms and procedures involved in specific kinds of terrorist attack 
(Freilich and Chermak, 2009; Kennedy, 2010). Accordingly, we focus on run-over 
attacks, a lethal attack method relatively common amongst lone attackers. 

Spaaij (2012) concludes that lone terrorists use weapons that are easy to come by. It 
is more difficult in Israel (than in the US, for example) to obtain firearms. Therefore, 
many lone terrorist attacks are committed by weapons that are easily acquired, such as 
knives, 6 Molotov cocktails or vehicles/heavy equipment (that is, tractors) to commit run- 
over attacks. Despite the relatively low volumes of run-over attacks in comparison with 
Molotov or even knife attacks, the potential lethality of run-over attacks is greater than 
that of other two forms of attack. 7 

Lone terrorists have far fewer resources than terrorist organizations and hence limited 
access to targets (Becker, 2014) and to weapons, tools and training. In line with the ‘four 
pillars’ of lone attack opportunities, it is expected that run-over attacks: 

a. occur primarily against soft targets in places that are familiar to the attacker (and 
do not require information gathering); 

b. are carried out by vehicles that are easily accessible to the attackers; 

c. do not require special training on the part of the attacker who drives the vehicle 
in the attack; 

d. take advantage of facilitating conditions; 

e. involve improvising for the most part and do not require a long decision-making 
process prior to executing the attack, which means that the time between making 
the decision to carry out the attack and the attack itself is relatively short. 

The present study of lone run-over attacks: Population and 
research method 

In this study, we examined all 62 run-over attacks carried out in Israel between January 
2000 and March 2016, resulting in 27 victims and 253 injured. In this regard, it is impor¬ 
tant to note that, in contrast to many studies on terrorism, the cases for the current study 
were not sampled; rather, the entire population of run-over lone-actor attacks in Israel 
within this period is included and analysed. 

Data collection for this study included over 100 variables related to each attack, 
obtained over two and a half years from both confidential and open sources. Three 
research assistants with appropriate intelligence clearance were allowed to review the 
confidential records of each of the run-over attackers and attacks. They reviewed the 
records following a list of variables, related to (1) the personal characteristics of the 
attackers and (2) the characteristics of the attacks in regard to the target, weapon, tools 
and facilitating conditions. In order to maintain consistency in the data collection and not 
lose information, the assistants were given identical instructions regarding what informa¬ 
tion needed to be obtained regarding each of the variables. When questions were raised 
about the meaning and/or the interpretation of information regarding a specific variable 
and how this information should be encoded, the research assistants were instructed to 
contact the principal investigators, who made a clarification (which was then passed 
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along to all of the research assistants). Because the process involved three research assis¬ 
tants, in the final process one research assistant reviewed all of the information collected 
and was responsible for encoding and declassifying the information (to ensure that 
sources or methods were not revealed). 

Information was also gathered on the same attacker and attack-related variables from 
open sources. Two additional research assistants reviewed court proceedings and deci¬ 
sions; these contain many documents elaborating on the factual element (actus reus) of 
these attacks, as well as information about the criminal intent. The research assistants 
also reviewed additional open sources, such as news sites and other media publications 
on the attacks and the attackers, public databases, social media and some clips of the 
attacks (taken by bystanders or CCTV cameras). These two research assistants were also 
given identical instructions regarding what information needed to be obtained regarding 
each of the variables. Similarly, the principal investigators made decisions when ques¬ 
tions were raised about the meaning and/or the interpretation of an information item and 
how this information should be encoded. Once again, one research assistant reviewed all 
the information collected and the encoding of the information. 

For each of the run-over cases, information was gathered and examined on the attack 
using the following parameters: attack date and time, chosen location, type of target (that 
is, bus station, intersection) and whether it was directed against civilians or security 
forces, whether the site of the attack was linked to the attacker (that is, whether the attack 
was carried out in an area that was part of the assailant’s daily routine area of residence 
or work), and personal information (name, age, marital status, place of residence, health, 
education, jobs, socioeconomic status, association with a terrorist organization, religious 
affiliation). Information was also gathered with regard to whether the attacker displayed 
unusual behaviour prior to the attack, which might have indicated something about their 
condition and/or their intentions to attack. We examined how the perpetrator obtained the 
vehicle used in the attack, tried to understand whether the attack was carried out sponta¬ 
neously or was planned, and sought to learn whether there were secret partners involved 
or who were aware of the planned attack. 

In the last phase, the data gathered from both confidential and open sources were 
coded into a comprehensive data set. To minimize any potential gaps in the coding pro¬ 
cess, only the principal research assistant overseeing data collection was in charge of this 
coding. The coded database was then reviewed by the principal investigator and one 
other research assistant and randomly compared with the content of the cases to verify 
the consistency of the coding. 

Findings 

This section presents an analysis of the related variables of all 62 run-over attacks com¬ 
mitted in Israel and the West Bank between January 2000 and March 2016. All of the 
attacks were carried out by Muslims; most were male (59, or 95.2 percent); three attacks 
(4.8 percent) were carried out by Muslim women. Run-over attacks were not evenly 
spread during the research period. We included in our study events since the year 2000, 
the beginning of the ‘second Intifada’, although the years up to 2007 were characterized 
by a relatively low popularity of this modus operandi. This changed in 2008, when lone 
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Figure I. How did the offender obtain the vehicle? 


run-over attacks became more frequent, reaching a peak during the years 2014-16. In 
2015, during a significant wave of terrorist attacks in Israel, run-over attacks reached an 
all-time record of 33 documented events. 8 

We divide the findings into three sections. The first section presents findings related 
to the terrorist attack itself, following the four pillars of opportunity: weapon, target, 
tools and training, and facilitating conditions. Next, we describe the findings related to 
the number and the outcomes of the attack - the number and nature of the casualties and 
the fate of the attacker. Finally, we present the findings regarding the spontaneity of 
attacks and the pre-attack warnings. 

Characteristics of run-over attacks: The ‘four pillars’ of opportunity 

The limited resources available to lone attackers, have a direct effect on the four pillars 
of the situational opportunity, as the following findings demonstrate. 

Weapon. All of the attackers in our study selected a vehicle as their weapon of choice. 
However, 14 of the attacks (22.6 percent) were followed by an armed assaidt (for exam¬ 
ple, stabbing), and 48 attacks (77.4 percent) were run-over attacks only; 13 of the 
attacks (21 percent) involved multiple events. To examine the hypothesis that lone ter¬ 
rorists tend to choose a simple weapon that is easy to get and operate, we analysed how 
each attacker obtained the vehicle used in the attack. As can be seen in Figure 1, vehi¬ 
cles were readily accessible for most of the attackers. Out of 41 cases for which the 
source of the vehicle is known, in more than half (22 cases, or 53.7 percent) the attack¬ 
ers used their own vehicle. In eight cases (19.5 percent) the offenders used a vehicle 
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Figure 2. The target and location of the run-over attack. 


they obtained from their workplace, and in an additional three cases a vehicle belonging 
to a friend was used. In only eight cases (19.5 percent) had the offender stolen a vehicle 
in order to carry out the attack. 

As to the vehicle type, 49 were private cars (79 percent), 5 tractors (8.1 percent), 3 
trucks (4.8 percent), 4 taxis (6.5 percent) and 1 bus (1.6 percent). The fact that attacks 
were carried out by a variety of vehicle types demonstrates that this weapon was chosen 
by the perpetrator because of its availability and accessibility to the attacker through 
personal ownership or work. 

Target. Lone attackers’ lack of resources can be expected to encourage them to choose 
soft targets that do not require much preparation. Indeed, the findings in the case of run- 
over attacks clearly show that all the attacks were carried out in public places: bus sta¬ 
tions, pickup stations for hitchhikers, checkpoints or intersections. These locations are 
characterized by the gathering and movement of relatively numerous civilians, as well as 
security forces. Such places present an easy situational opportunity for a run-over attack. 
As can be seen in Figure 2, most of the attacks (35, or 56.5 percent) took place either in 
an open public space, such as a pedestrian passage or a junction (22, or 35 percent), or in 
public transportation sites (13, or 21 percent). In line with the findings of Hamm and 









Table I. Distance from attacker’s residence to the attack location. 


Distance 

Frequency 

Percent 

Cumulative percent 

Same place 

3 

5.3 

5.3 

1-5 km 

22 

38.6 

43.9 

6-10 km 

13 

22.8 

66.7 

1 1-15 km 

7 

12.3 

78.9 

More than 15 km 

12 

21.1 

100 

Total 

57 

100 



Spaaij (2015) that police and military officers have become the preferred target for lone 
wolves, the rest of the attacks targeted military checkpoints (12, or 19.4 percent), mili¬ 
tary patrols (10, or 16.1 percent) and police stations or cars (5, or 8.1 percent). 

The run-over attackers chose targets in places with which they were familiar, and 
therefore did not require information gathering (about the target, the target area and the 
route to the target and for escape). In this regard, we found that in the majority of the 
attacks (at least 38 cases, or 61 percent) there were indications that the location of the 
attack was familiar to the attacker: where they lived, worked, did their shopping or 
passed on a daily basis. 

Not only were the attackers familiar with the attack location, but the findings indicate 
that their choice was based on distance as well. Table 1 presents the distance between the 
attacker’s residence and the location of the attack; 25 of the attacks (43.9 percent) 
occurred within less than 5kmof the attackers’ home, 13 attacks between 6 and 10km 
(22.8 percent), 7 from 11 to 15km (12.3 percent), and only 12 were over 15km away 
(21.1 percent). For five cases, the home address was unknown. 

Another possible explanation for this finding might be connected to the combina¬ 
tion of personal and political/religious factors, which research has found to be con¬ 
tributing factors for lone wolf attacks. Conflicts with family, community norms, 
friends, employers, etc., may trigger the loner to action within neighbourhood or work 
settings. 

Tools and training. In run-over attacks, the vehicle is used both as the weapon and as the 
tool by which the attacker gets to the scene of the attack. This use of the car as a tool to 
access the event location often relied on the attacker’s profession: 14 of the attackers 
(22.6 percent) were drivers, had legitimate licences and had received driving instruction, 
in this case training in the usage of what was both the weapon and the mode of transpor¬ 
tation to the attack scene. 

A run-over attack using the vehicle as a weapon does not require special training in 
operating a weapon. Any driver or heavy machinery operator can turn the vehicle into an 
effective weapon. The fact that training and planning are not a significant part of run- 
over attacks facilitates the opportunity to attack without lengthy preparations. This most 
likely explains the short time interval between planning and attacking in the 72 percent 
of known cases that were spontaneous or same-day attacks. 
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Average number of people wounded per 
attack in Israel in comparison to the West 
Bank 2000-2016 



■ Israel ■ West Bank 


Figure 3. Number of wounded: Run-over attacks in Israel and in the West Bank, 2000-16. 


Other indications of the level of planning and training can be found in the form of 
indicators that the attacker was preparing an additional attack or was engaged in dry runs 
prior to the event. In only 11 cases (18 percent) was there evidence to suggest that the 
individual had plans for further attacks. Indications that the attackers engaged in dry runs 
were found in only four cases (6 percent). 

Facilitating conditions. There are many more available targets and potential victims 
inside Israel as compared with the West Bank. As we can see in Figure 3, run-over 
attacks inside Israel are more injurious and should therefore result in more attacks 
inside Israel than in the West Bank. Since only East Jerusalem and Israeli residents 
can move freely inside Israel, this capability can be considered as a facilitating 
condition. 

The findings indicate that the place of residence and the possession of permits related 
to that place served as facilitating conditions for many of the attackers, allowing them to 
travel freely in Israel. This is reflected in the fact that 40.4 percent of the run-over attacks 
(25) were committed inside Israel by either East Jerusalem residents (21, or 33.9 percent) 
or Israeli Arabs (4, or 6.5 percent). On the other hand, 34 of the attackers (54.8 percent) 
lived in the West Bank and committed the attack there (since they did not have the ability 
to travel into Israel), targeting Israeli settlers or soldiers serving in the West Bank. Two 
additional attacks were carried out by people who were originally from the Gaza Strip 
but were staying in the West Bank at the time of the attack, and one attacker’s (out of 
two) home address was unknown. Accordingly, 18 of the attacks took place in Jerusalem 
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Morning 


48.40% 



4.80% 


3.20% 


Afternoon Evening and night Unknown 


Figure 4. Run-over attacks by time of day. 


(29.5 percent), 5 in Tel-Aviv and its surrounding area, 1 in the north of Israel (9.9 per¬ 
cent), and 37 (60.7 percent) in the West Bank. 

To examine the frequency of the facilitating condition of ‘copycat’ attacks, we looked 
at run-over attacks carried out shortly after a previous attack and that demonstrated simi¬ 
lar characteristics and occurred in the same area. We found that 27 of the attacks (44.3 
percent) could be considered ‘copycat’ attacks. These 27 events took place less than a 
week after a previously successful attack. Most of them (20) occurred less than three 
days after the previous attack. 

Timing the attack during the day can also facilitate a successful attack. Specific time 
slots can facilitate the approach to the event location: for example, during working hours 
a truck or a tractor making its way through central roadways may go unnoticed. Choosing 
the right time slot may also increase the potential for casualties: targeting a public trans¬ 
portation site at the end of a work day can be more effective than targeting the same 
location in the middle of the night. The dispersion of events by time of day can be seen 
in Figure 4. 

As can be seen in Figure 4, most of the attacks took place in the morning (5:00-12:00) 
or afternoon (12:01-18:00): 27 attacks (43.5 percent) and 30 attacks (48.4 percent), 
respectively. Very few attacks (three, or 4.8 percent) occurred during the evening and at 
night (between 18:01 and 04:59). In two cases the exact time of the attack is unknown 
(3.2 percent). 

Number and outcome of attacks 

The findings highlight some important trends in the number of run-over attacks commit¬ 
ted over the study period and in the outcome of these attacks. From the year 2000, there 
was a significant rise in the popularity of run-over attacks as a terrorist modus operandi: 
from one event in 2000 and then several years without any events (2003 to 2007), to 4 
events in 2008, 7 in 2014 and 33 in 2015, all committed by lone actors. 
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As for the fate of the attacker, 24 terrorists were arrested following the attack (38.7 
percent) and 36 were killed during the attack (58.1 percent); for the remaining 2 cases the 
fate of the attacker is unknown. In most cases (39, or 72 percent) it was police or military 
forces who stopped the attacker - police officers operating within Israel (19, or 35.2 
percent) and soldiers in the West Bank (20, or 37 percent); see Figure 5. Civilians were 
responsible for stopping the attacker in four of the cases (7.4 percent), and in an addi¬ 
tional four cases they did so jointly with either police officers or military forces (7.4 
percent). In seven cases the attacker was not stopped (13 percent). 

An independent-samples /-test was conducted to compare the number of those 
injured in attacks committed by attackers who were trained as professional drivers with 
attackers who were not professional drivers. There was a significant difference in the 
scores for professional (M = 7.57, SD = 9.78) and non-professional drivers (M= 3.06, 
SD = 3.19; t (60) = 2.77, p = .00). These results suggest that attacks committed by 
attackers trained as professional drivers led to a larger number of injured. This finding 
can probably be attributed to the fact that professional drivers more frequently than non¬ 
professional drivers use heavy equipment such as tractors, buses and trucks, which can 
cause greater damage. 
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(out of 18 known cases 29%) 



Figure 6. Time intervals between planning and attacking. 


Spontaneity of some attacks and pre-warning of others 

As mentioned, run-over attacks require little advance planning or logistical support. 
Therefore, this study focusing on the attack examined how long it took to prepare the 
attack; specifically, how much time passed between the decision to carry out the attack 
and the attack itself (see Figure 6). In this regard, the findings revealed a substantial find¬ 
ing about the run-over attacks: at least 8 of the attacks were spontaneous, 5 occurred on 
the same day as the decision to attack and 4 occurred in the same week (there was infor¬ 
mation about the time interval between planning and attacking in 18 cases). 

Another substantial finding regarding the period prior to the run-over attack is that at 
least in 26 (41.9 percent) cases that were not spontaneous we found in retrospect that 
there had been an early indication of a potential attack. The various pre-warning attack 
indicators are presented in Figure 7. 

As can be seen in Figure 7, out of 26 cases for which there are indicators of some type 
of pre-warning, in 8 of the attacks (30.8 percent) there were letters or public statements 
prior to the event, in 11 attacks (42.3 percent) there were verbal statements made to fam¬ 
ily or friends, and in 4 (15.4 percent) there were verbal statements to a wider audience. 
In 22 of the cases (84.6 percent) at least one other person knew in advance about the 
attacker’s grievance, 9 in 24 of the cases (92.3 percent) at least one other person knew in 
advance about the attacker’s extremist ideology, and in 5 cases (19.2 percent) the attacker 
provided a specific pre-event warning. These findings suggest that, in contrast to the 
common perception that lone-actor attacks are impossible to predict, in many cases there 
is some advance indication of the coming attack. 
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Type of pre-warning 

out of 26 (42%) cases with known pre-warning 


92.3% 



Produced a letter Made verbal Made verbal At least one other At least one other Provided a 
or public statements to statements to a person knew person knew specific pre-event 
statement (8) family or friends wider audience about the about the warning (5) 

(11) (4) attacker's attacker's 

grievance (22) extrimist ideology 
(24) 


Figure 7. Pre-warnings for run-over attacks. 


Discussion and conclusions 

In an attempt to investigate what the situational conditions are that facilitate the occur¬ 
rence of lone wolf run-over attacks, this study has focused on the actual offences (the 
‘criminal events’) rather than the offenders (for which previous studies did not find a 
unique profile). The study has attempted to describe the situational circumstances, as 
well as the terrorists’ capabilities and resources, that shaped the choices made by the lone 
run-over attacker. 

As to the main question leading to this study, the findings reveal common character¬ 
istics of lone run-over attacks. They show that, as expected, lone run-over attacks are 
dictated by the immediate circumstances of the situation (Clarke, 1997). In line with the 
predictions of this study they are directly shaped by the ‘four pillars’ of lone attack 
opportunities (targets, weapons, tools and training, and facilitating conditions). The find¬ 
ings reveal that lone run-over attackers compensate for their lack of resources by taking 
advantage of nearby situational opportunities. Examples of such situational opportuni¬ 
ties, as revealed in our findings, are, firstly, that attackers chose easily accessible public 
places frequented by civilians and security forces (for example, bus stations, pickup 
stations for hitchhikers). Secondly, the sites selected by run-over terrorists were located 
in close proximity to the area where they lived or conducted their daily lives and, in most 
cases, with which they were familiar. This second conclusion is in line with that of Clarke 
and Newman (2006): terrorists attack targets that are closer to their base of operations, 
within their familiar environment. A third example of situational opportunity found in 
our study pointed to the fact that in most attacks perpetrators used an easily available 
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weapon: their own vehicle or a vehicle provided to them from work. The finding suggest¬ 
ing that attacks committed by professional drivers cause more damage is another exam¬ 
ple of situational opportunity. Taking advantage of access to vehicles and training as a 
professional driver is similar to ex-military personnel in the US making use of their 
training and knowledge for attacks (Gill, 2015). Therefore, SCP tactics should not only 
address ‘target hardening’ but also screen individuals who are authorized to operate 
heavy equipment (a vivid example is the terrible attack in Nice, France). 

Between the end of 2015 and the beginning of 2016, the local municipal authorities in 
partnership with the Israel Police and other governmental offices began fortifying bus 
stations with concrete and metal columns, initially in areas adjacent to sites where attacks 
had previously occurred. These simple measures of target hardening are presumed to 
have reduced not only the number of run-over attacks but also the severity of the conse¬ 
quences of such terrorist attacks (see Figure 8 in Appendix A for the average number of 
wounded). These findings demonstrate the effectiveness of SCP methods, which can 
prevent lone run-over attacks in places that present an easy situational opportunity for 
such attacks. Essentially, situational prevention by, for instance, adding simple protec¬ 
tion in locations such as bus stations and hitchhiking spots that are easily accessible to 
potential run-over attackers has been an effective counter-measure response. 

The finding of previous studies that there is no unique distinctive profile of the run- 
over lone terror attacker, together with the findings of the current study that there are 
certain characteristics of lone run-over attacks, is noteworthy. These findings suggest 
that, in order to prevent run-over terrorist attacks or to minimize the damage, one should 
not concentrate primarily on identifying the profile of the potential attacker. Rather, 
effective counter-measures should identify the run-over attack elements and introduce 
SCP measures that have been found to be effective in preventing non-terrorist crime 
(Guerette and Bowers, 2009). According to Rational Choice theory, offenders’ decisions 
to commit crimes for personal gain and benefit are heavily influenced by situational 
incentives and opportunities. The situational opportunities of a specific setting determine 
its attraction to the offender and are influenced by factors such as the accessibility of 
commendable targets and valuable victims, acquaintance with the territory, accessibility 
of the location, escape routes, hiding places, potential collaborators, habit, etc. Changing 
and reducing situational opportunities for committing terrorist attacks could affect the 
cost-benefit assessments of the incentives and risks. Therefore, utilizing SCP techniques 
that could result in the attack being perceived by the perpetrator as much more compli¬ 
cated and costly should be effective in preventing future attacks (‘criminal event’). 
According to our findings, applying SCP can specifically prevent lone run-over attacks. 
This is particularly relevant because recent studies have tested the effectiveness of SCP 
in reducing opportunities for terrorism and found that attacks for the most part were not 
displaced to other locations (Hsu and Apel, 2015; Perry et al., 2017). This is most likely 
because the situational opportunities present in alternative locations were perceived as 
less favourable. 

This study has revealed two noteworthy findings regarding the spontaneity of some of 
the lone run-over attacks and the pre-warnings of other attacks. Sufficient intelligence 
gathering and analysing capabilities could possibly have foiled attacks, at least in some 
of the 26 cases (41.9 percent of the total cases) that, in retrospect, were found to have 
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pre-warning indicators of an attack. This means that also in cases of lone wolf terrorism 
it is important to develop intelligence tools by practising ‘high policing’ (focusing on 
strategic issues at a macro level, utilizing proactive methods) in order to identify poten¬ 
tial attackers. One application for ‘high policing’ has recently been conducted by the 
Israeli Security Agency (ISA), which, owing to intensified incitement through social 
networks and other web venues, has been engaging in a variety of counter-measures. 
Methods were designed to identify the most influential channels of incitement in various 
social networks. Once individuals are identified as potential threats, they are warned or 
arrested in the hope that these actions will disrupt and/or foil attacks. 10 

By contrast, at least 13 of the attacks were spontaneous or the decision to attack 
occurred on the same day. In these instances, no intelligence tools could have predicted 
the attack because even the attackers themselves did not yet know that they were going 
to commit an attack. In these cases, ‘high policing’ is much less effective and Tow polic¬ 
ing’ is necessary, primarily in the form of the SCP approach, a proactive network of 
community intelligence and the running of risk management models. Consequently, in 
lone run-over attacks, effective counter-terrorism combines ‘high policing’ and Tow 
policing’, which complement each other. 

Situational prevention of terrorism is based upon an understanding of the opportuni¬ 
ties and consequences of the social, physical and technical characteristics of a given 
society that terrorists take advantage of when executing specific methods of attack 
(Freilich and Newman, 2009). In contrast to most of the run-over attacks, many lethal 
bombers and lone shooter attackers (such as Anders Breivik, Theodore Kaczynski, 
Joseph Paul Franklin, and Eric Rudolph) have not acted locally but have travelled hun¬ 
dreds of miles from home to reach their target(s). We therefore recommend that future 
studies on lone wolf terrorists should study other types of attack, such as stabbing, bomb¬ 
ing and shooting. 

As mentioned, we do not belittle the long-term importance of reducing the motiva¬ 
tion to attack (for religious, political, economic, psychological, social and other factors 
that foster terrorism). Conflict resolution by political and diplomatic means is not 
always possible in the short term and is often very difficult, frequently becoming even 
more complicated as a result of ongoing terrorist attacks. The challenges faced when 
dealing with the root causes of terrorism are in a way similar to the difficulties that 
societies face when treating the source of crime in general. Clarke and Newman (2006) 
claim that, unlike in political approaches, it is necessary to focus on foiling terrorism 
through situational prevention: ‘we must not rely on changing the hearts and minds of 
terrorists’ (Clarke and Newman, 2006: 11). One should also remember that an important 
part of ‘criminal involvement’ (in this study, the decision to become a lone run-over 
attacker) is the prospect of succeeding. Hence negatively upsetting the cost-benefit 
assessments of a ‘criminal event’ is also expected to negatively affect the motivation to 
become a terrorist. 

This study specifically examines lone terrorist run-over attacks, consistent with the 
recommendation to study particular kinds of terrorist attack. When considering our 
ability to generalize the findings of this study, we should bear in mind two important 
facts: 
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(a) Although the research was done in Israel, we have a strong basis to assume that 
the analysis would also apply to other Western democracies. Yet we should 
beware of generalizations and be sensitive to the sociopolitical context. 

(b) The literature presents many common denominators (as they appear in the ‘four 
pillars of opportunity’) amongst the various types of lone terrorist attack. The 
findings of this study confirm our hypotheses regarding these common elements. 
We think that the recommendation to study different kinds of lone terrorist attack 
is very valid, since we cannot know to what extent run-over lone attacks are simi¬ 
lar to other sorts of lone attack. For these reasons, we recommend that future 
studies should examine other kinds of lone attack as well as studying lone run- 
over attacks in other parts of the world. 
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Notes 

1. Known also as lone attackers or lone terrorists. 

2. See, for example, the 2012 Europol statistical report (EUROPOL, 2012: 17). 

3. See, for example, Batley (2015). See also CBS Las Vegas (2014). 

4. It should be noted that Becker included a number of law enforcement sting cases in his sample 
and that the targets were selected by government informants or FBI agents. 

5. See http://www.algemeiner.com/2015/10/18/disappointed-in-failure-of-stabbings-hamas-calls- 
on-palestinians-to-drop-knives-commit-car-rammings-for-higher-jewish-casualties/. 

6. We are currently conducting other research that is studying stabbing attacks by lone jihadists 
in Israel. 

7. Website of the Israeli Security Agency (ISA) (2010). 

8. For details about the 2015 terror wave, see the ISA report at: https://www.shabak.gov.il/ 
English/EnTerrorData/Reviews/Pages/skira091215 .aspx. 

9. A similar percentage of lone actors who expressed their intention to commit violence prior to 
an attack were also reported in a recent US study (Hamm and Spaaij, 2015). 

10. See https://www.shabak.gov.il/publications/study/Pages/ReportY2015.aspx. 
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Figure 8. Yearly average number of wounded, 2008-16. 










